Blog
How to Check If Your Mail Server Uses Spamhaus Public Mirrors Before April 8, 2026
April 8, 2026 is in a week.
If your mail server queries Spamhaus blocklists using a public DNS resolver — 8.8.8.8 or 1.1.1.1 — those queries stop returning results on April 8.
Instead of blocklist data you get NXDOMAIN. Your spam filter silently stops working. You won't know unless you check.
What's Actually Changing
Spamhaus has always allowed public DNS queries to zen.spamhaus.org. Any mail server could check whether a sending IP was blacklisted.
From April 8 that changes. Only registered DQS (Data Query Service) accounts get valid responses. Everyone else gets NXDOMAIN — which looks the same as "not listed."
How to Check If You're Affected
You're affected if your mail server config contains any of these:
Postfix (main.cf):
reject_rbl_client zen.spamhaus.org reject_rbl_client sbl.spamhaus.org reject_rbl_client xbl.spamhaus.org
Exim:
deny dnslists = zen.spamhaus.org
SpamAssassin:
urirhssub URIBL_SBL multi.surbl.org
If you see zen.spamhaus.org without a DQS key prefix — you're affected.
The 10-Minute Fix
Step 1: Register at spamhaus.org/dqs. Free for self-hosted mail servers. Takes 2 minutes.
Step 2: Get your DQS key from the dashboard. It looks like: abcdef1234567890
Step 3: Update your mail server config.
Postfix before:
reject_rbl_client zen.spamhaus.org
Postfix after:
reject_rbl_client abcdef1234567890.zen.dq.spamhaus.net
Step 4: Reload your mail server config:
systemctl reload postfix
Step 5: Test the new config:
dig 2.0.0.127.abcdef1234567890.zen.dq.spamhaus.net
Should return 127.0.0.2 — confirming the DQS key is working.
Is DomainPreflight Affected?
No. DomainPreflight's Email Deliverability tool already uses Spamhaus DQS. The IP blacklist checks continue working after April 8 without any changes.
Check your IP reputation
Email Deliverability →FAQ
What is Spamhaus sunsetting on April 8?
Public DNS mirror access — queries to zen.spamhaus.org via public resolvers like 8.8.8.8 will return NXDOMAIN instead of blocklist results. Only DQS registered accounts continue to work.
How do I know if my server is affected?
Check your mail server config for zen.spamhaus.org without a DQS key prefix. Postfix users check main.cf. Exim users check the ACL config.
Is the DQS key free?
Yes for self-hosted low-volume mail servers. Register at spamhaus.org/dqs. Commercial use requires a paid plan.
What happens if I do nothing?
Your Spamhaus blocklist checks return NXDOMAIN — same as "not listed." Spam that Spamhaus would have blocked starts getting through. No warning, no error message.
Does this affect DomainPreflight?
No — DomainPreflight already uses Spamhaus DQS. No changes needed on your end.